Today, information security is one of the critical concerns in computer networks and services. Various methods have been developed for protection of various resources and services; usually these methods include implementation of one or more security policies, combinations and hierarchies thereof. Typically, a security policy implemented in a respective rule-set includes control of inbound and outbound traffic related to certain resources. Such control is enforced with the help of one or more security gateways, which may comprise various devices and/or combinations thereof (e.g. switches, routers, firewalls, VPN devices, load balancers, etc.).
However, maintaining the security rule-set, especially in complex network architecture, presents an increasing challenge to security departments worldwide. The problems of security rule-set management, including proposing amendments for current policy and/or verifying thereof, have been recognized in the Prior Art and various systems have been developed to provide a solution as, for example:
U.S. Pat. No. 6,098,172 (Coss et al.) discloses a firewall supporting multiple security policies and/or multiple users by applying any one of several distinct sets of access rules. The firewall can also be configured to utilize “stateful” packet filtering which involves caching rule processing results for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent similar packets. Dynamic rules may be used in addition to pre-loaded access rules in order to simplify rule processing.
U.S. Pat. No. 6,826,698 (Minkin et al.) discloses a system, method and computer program product for affording network security features. The method includes: identifying a plurality of network objects; retrieving rule-sets associated with at least one of the identified network objects, the rule-sets including a plurality of policy rules that govern actions relating to the identified network objects; reconciling overlapping policy rules of the rule-sets amongst the network objects; and executing the reconciled rule-sets.
US Patent Application No. 2003/212657 (Lu et al.) discloses an extensible rules engine that uses database technology that provides a rules evaluation service for applications external to the database server or database management system. Applications are able to utilize the rules engine to provide alternative behaviors based on information against which specified conditions are evaluated. A framework is provided for specifying data definitions that can be referenced by user-defined rules, through creation and use of an evaluation context. Application-specific data types can be defined by specifying data tables and/or variables that can be referenced by rules created for evaluation against data that is associated with the evaluation context.
US Patent Application 2007/094707 (Karch) discloses a rules-based system enforcing security policies in a data access management system. The rules based system provides rules that preclude certain activities, but those rules are only implemented and fired upon certain conditions occurring. This results in certain actions being precluded when specified conditions are true, without additional software required to check for the condition each time the action is requested.
US Patent Application No. 2008/215518 (Matsuda) discloses a filtering rule analysis system for analyzing the rules of a packet filtering process that is set in network devices. The system includes: a rule storage for storing sets of rules for which an order of priority has been established; a matrix generator for generating matrix spatial data that contains information of the order of priority and that indicates the correspondence relation between a minimum region identified by starting points and end points of ranges of packet attributes described in each rule as the condition of application of that rule and those rules; and an overlap analyzer for referring to the matrix spatial data to analyze overlap between the rules.
US Patent Application No. 2008/282313 (Diez-Cuellar et al.) discloses a computer-readable medium having a data structure stored thereon for defining a schema for expressing a network security policy. The data structure includes a first data field including data defining a parameter to be applied based on the network security policy. The network security policy defines at least one of the following: a firewall rule and a connection security rule. The data structure also includes a second data field having data specifying restrictions of the parameter included in the first data field. The parameter in the first data field and the restrictions in the second data field form the schema for expressing the network security policy to be processed. The network security policy manages communications between a computing device and at least one other computing device.
US Patent Application No. 2010/011433 (Harrison et al.) discloses a rule-set generator and a method of automated configuration of a security gateway. The method comprises setting-up an initial rule-set; obtaining log records of communication events corresponding to the initial rule-set so as to obtain a sufficient amount of log records; transforming the obtained log records into respective rules, wherein source, destination and service fields in each rule correspond to source, destination and service values in respective obtained log record, and the action in all rules is defined as “Accept”, thus giving rise to a transformation-based rule-set; and processing the transformation-based rule-set so as to generate an operable rule-set.